Skip to content

chore(ci): use github app for tokens #6534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 28, 2024
Merged

chore(ci): use github app for tokens #6534

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
19e3a98
chore(ci): use github app for tokens
nirinchev Nov 27, 2024
5fd7bd8
Use @main
nirinchev Nov 27, 2024
ea854e8
Update contributing.md
nirinchev Nov 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 1 addition & 12 deletions .github/workflows/authors-and-third-party-notices.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,18 +16,12 @@ jobs:
HADRON_DISTRIBUTION: compass
steps:
- name: Create Github App Token
uses: actions/create-github-app-token@v1
uses: mongodb-js/devtools-shared/actions/setup-bot-token@ni/github-app-action
id: app-token
with:
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}

- name: Get GitHub App User ID
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The removed steps in this file have been moved to our setup-bot-token action.

id: get-user-id
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}

- uses: actions/checkout@v4
with:
# don't checkout a detatched HEAD
Expand All @@ -38,11 +32,6 @@ jobs:
fetch-depth: "0"
token: ${{ steps.app-token.outputs.token }}

- name: Set up Git
run: |
git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>'

- uses: actions/setup-node@v4
with:
node-version: 20.16.0
Expand Down
35 changes: 16 additions & 19 deletions .github/workflows/bump-packages.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,24 +10,22 @@ jobs:
name: Bump packages
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Create Github App Token
uses: mongodb-js/devtools-shared/actions/setup-bot-token@ni/github-app-action
id: app-token
with:
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}

- uses: actions/checkout@v4
with:
# don't checkout a detatched HEAD
ref: ${{ github.head_ref }}

# this is important so git log can pick up on
# the whole history to generate the list of AUTHORS
fetch-depth: '0'
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're not updating AUTHORS in this workflow, so this seems unnecessary


- name: Setup git
run: |
git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config --local user.name "github-actions[bot]"

- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: 20.16.0
cache: 'npm'
cache: "npm"

- name: Install [email protected]
run: |
Expand All @@ -40,21 +38,20 @@ jobs:

- name: Bump packages
env:
LAST_BUMP_COMMIT_MESSAGE: 'chore(release): bump package versions'
SKIP_BUMP_PACKAGES: 'mongodb-compass'
LAST_BUMP_COMMIT_MESSAGE: "chore(release): bump package versions"
SKIP_BUMP_PACKAGES: "mongodb-compass"
run: |
npm run bump-packages
git add .
git commit --no-allow-empty -m "$LAST_BUMP_COMMIT_MESSAGE" || true

- name: Create Pull Request
id: cpr
uses: peter-evans/create-pull-request@v6
uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # 7.0.5
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For 3rd party packages, we should use git commit shas instead of version tags as those can be force pushed.

Copy link
Collaborator

@gribnoysup gribnoysup Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a documentation for this that we can point to somewhere around this code? It's not obvious and would be very easy to revert back over time without noting why we are doing this

Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's part of the general security hardening recommendations for actions: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

While I don't have reasons to mistrust Peter, a rule of thumb I tend to follow is to use versions for actions by corporations such as microsoft, github, amazon, where there's strong expectation that they have security practices in place that would prevent access to their code. And for everything else, even if it's a popular action, I pin the commit sha.

Copy link
Collaborator

@gribnoysup gribnoysup Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cool, so can we add this link somewhere around this line (or any other place you think is appropriate) so that when someone is going over this code in the future and is unsure why exactly this is set to a hash instead of a version the rule is still followed?

Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we should be adding comments as the commit sha usage should be the default for any 3rd party action. I did drop a message on slack though to bring more attention to this. I've also updated CONTRIBUTING.md with a section highlighting a few of the security best practices that also links to the full doc.

with:
token: ${{ secrets.SVC_DEVTOOLSBOT_TOKEN }}
commit-message: 'chore(release): bump package versions'
token: ${{ steps.app-token.outputs.token }}
commit-message: "chore(release): bump package versions"
branch: ci/bump-packages
title: 'chore(release): bump package versions'
title: "chore(release): bump package versions"
labels: no-title-validation
body: |
- Bump package versions
11 changes: 8 additions & 3 deletions .github/workflows/merge-bump-packages-pr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,23 @@ on:
workflow_dispatch:
schedule:
# Each Tuesday at 5 AM UTC
- cron: '0 5 * * 2'
- cron: "0 5 * * 2"

jobs:
merge_bump_packages_pr:
name: Merge bump packages PR
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checkout seems unnecessary here as we don't use anything from the repo

- name: Create Github App Token
uses: actions/create-github-app-token@v1
id: app-token
with:
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}

- name: Merge PR
env:
GITHUB_TOKEN: ${{ secrets.SVC_DEVTOOLSBOT_TOKEN }}
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
set -e
PR_NUMBER=$(gh pr list -s open --head=ci/bump-packages --limit=1 --json number | jq '.[0].number')
Expand Down
42 changes: 19 additions & 23 deletions .github/workflows/update-electron.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,44 +11,40 @@ jobs:
name: Update Electron
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Create Github App Token
uses: mongodb-js/devtools-shared/actions/setup-bot-token@ni/github-app-action
id: app-token
with:
app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}
private-key: ${{ secrets.DEVTOOLS_BOT_PRIVATE_KEY }}

- uses: actions/checkout@v4
with:
# don't checkout a detatched HEAD
ref: ${{ github.head_ref }}

# this is important so git log can pick up on
# the whole history to generate the list of AUTHORS
fetch-depth: '0'

- name: Setup git
run: |
git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config --local user.name "github-actions[bot]"
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: 20.16.0
cache: 'npm'
cache: "npm"

- name: Install [email protected]
run: |
npm install -g [email protected]

- name: Install Dependencies
run: |
npm -v
npm ci
run: npm ci

- name: Bump packages
run: |
node scripts/update-electron.js
git add .
git commit --no-allow-empty -m "chore(deps): update electron" || true
Comment on lines -42 to -43
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The create-pull-request action will automatically add and commit, so no need to do it here

run: node scripts/update-electron.js

- name: Create Pull Request
id: cpr
uses: peter-evans/create-pull-request@v6
uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # 7.0.5
with:
token: ${{ secrets.SVC_DEVTOOLSBOT_TOKEN }}
commit-message: 'chore(deps): update electron'
token: ${{ steps.app-token.outputs.token }}
commit-message: "chore(deps): update electron"
branch: ci/update-electron
title: 'chore(deps): update electron'
title: "chore(deps): update electron"
labels: no-title-validation
body: |
- Update electron
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ In particular each change to the `main` branch is analyzed to calculate a new ve

Merging that PR will trigger another CI job that will publish to NPM any package which version is not yet present on the registry.

The version of packages is calculated following conventional bumps: See https://github.com/mongodb-js/devtools-shared/tree/main/packages/bump-monorepo-packages for details.
The version of packages is calculated following conventional bumps: See https://github.com/mongodb-js/devtools-shared/tree/main/packages/monorepo-tools for details.
Copy link
Collaborator Author

@nirinchev nirinchev Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a drive-by - noticed the link is outdated


## Add / Update / Remove Dependencies in Packages

Expand Down
Loading